CVE Vulnerability Catalog

The Linux kernel before 5.13.4 has incorrect connection-setup ordering in fs/nfs/nfs4client.c. Operators of remote NFSv4 servers can cause a denial of service (hanging of mounts) by making those servers unreachable during trunking detection.

arch/x86/kvm/mmu/paging_tmpl.h in the Linux kernel before 5.12.11 incorrectly computes the access permissions of a shadow page, leading to a missing guest protection page fault.

curl supports the `-t` command line option, known as `CURLOPT_TELNETOPTIONS` in libcurl. This rarely used option is used to send variable=content pairs to TELNET servers. Due to flaw in the option parser for sending `NEW_ENV` variables, libcurl could be made to pass on uninitialized data from a stack based buffer to the server. Therefore potentially revealing sensitive internal information to the server using a clear-text network protocol. This could happen because curl did not call and use sscanf() correctly when parsing the string provided by the application.

When curl is instructed to get content using the metalink feature, and a user name and password are used to download the metalink XML file, those same credentials are then subsequently passed on to each of the servers from which curl will download or try to download the contents from. Often contrary to the user's expectations and intentions and without telling the user it happened.

When curl is instructed to download content using the metalink feature, the contents is verified against a hash provided in the metalink XML file. The metalink XML file points out to the client how to get the same content from a set of different URLs, potentially hosted by different servers and the client can then download the file from one or several of them. In a serial or parallel manner. If one of the servers hosting the contents has been breached and the contents of the specific file on that server is replaced with a modified payload, curl should detect this when the hash of the file mismatches after a completed download. It should remove the contents and instead try getting the contents from another URL. This is not done, and instead such a hash mismatch is only mentioned in text and the potentially malicious content is kept in the file on disk.

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because the protection mechanism neglects the possibility of uninitialized memory locations on the BPF stack.

In the Linux kernel through 5.13.7, an unprivileged BPF program can obtain sensitive information from kernel memory via a Speculative Store Bypass side-channel attack because a certain preempting store operation does not necessarily occur before a store operation that has an attacker-controlled value.

In MISP version 2.4.147, there is a Stored XSS vulnerability in app/View/GalaxyElements/ajax/index.ctp that can be exploited when viewing galaxy cluster elements in JSON format.

In MISP version 2.4.147, there is a stored XSS vulnerability in the view_relation_tree.ctp file, allowing malicious code execution when viewing galaxy cluster relationships.

An integer overflow in util-linux through 2.37.1 can potentially cause a buffer overflow if an attacker were able to use system resources in a way that leads to a large number in the /proc/sysvipc/sem file. According to the vendor, this is unexploitable in GNU C Library environments and possibly in all realistic environments.

In MISP version 2.4.146, there is a Stored XSS vulnerability in app/View/GalaxyClusters/add.ctp that can be exploited when forking a galaxy cluster.

Cross-site scripting (XSS) vulnerability in SourceCodester CASAP Automated Enrollment System v 1.0 allows remote attackers to inject arbitrary web script or HTML via the class_name parameter to update_class.php.

In the Linux kernel up to version 5.13.4, the function hso_free_net_device in drivers/net/usb/hso.c calls unregister_netdev without checking the NETREG_REGISTERED state, leading to a use-after-free and a double free.

Vulnerability in PeopleSoft Enterprise CS Campus Community product (component: Integration and Interfaces) versions 9.0 and 9.2. Allows a low privileged attacker with network access via HTTP to gain unauthorized access to critical data.

In systemd before versions 246.15, 247.8, 248.5, and 249.1, basic/unit-name.c has excessive memory allocation (via strdupa and alloca) for a pathname controlled by a local attacker, leading to an operating system crash.

libarchive 3.4.1 through 3.5.1 has a use-after-free in copy_string (called from do_uncompress_block and process_block). This can lead to memory corruption when processing crafted archives.

A vulnerability in Windows Hello allows a security feature bypass. An attacker could exploit this flaw to bypass authentication mechanisms.

Information disclosure vulnerability in the Windows Remote Access Connection Manager. It may allow an attacker to access information that should be protected.

Information disclosure vulnerability in the Windows Remote Access Connection Manager. It may allow an attacker to access information that should be protected.